tegwick
024946e9da
Housekeeping the ruling left behind, plus the one piece of blocked work that was substantially ours to move. INFD-IN-0001 closed with its resolution recorded, matching approval-engine's IN-0002 form. It was still open after GH-DEC-2026-012 answered it. INFD-IN-0003 and docs/evidence-path-design.md take up O-02, which was sitting in the blueprint as "mechanism unchosen". Read independence and the local transactional outbox are settled and not in question. The real question is what travels, and it is sharper for us than for approval-engine because a presentation record carries the brief and packet material actually shown to a human. Three candidates with costs; proposal is commitment-only for Stage 1 — hashes, principal, timestamps, acks, co-referenced approval id — which discharges limit 3 and removes our ability to alter the record, while leaving us able to erase the content. That residual is declared alongside the existing compromised-surface one rather than papered over. Deliberately not proposing the full binding document unilaterally: it would put commercial and personal material into the audit fabric under retention and export entitlements designed for audit events. That is a meaningful change in what audit-core holds and is its owner's to accept, not ours to assume. The third option, a separate evidence store, is refused here because that store has no owner and inventing one routes around the §16 decision against stronger archival custody. Cadence declared and its form argued rather than copied: approval-engine's heartbeat answer suits genuinely low-volume classes, but ours are mixed — presentations are one per render, while dispositions and stance applications are low-volume and are the security-relevant ones. Reconciliation per class as primary, heartbeat for the low-volume classes. Depends on AUDIT-WP-0009 T04/T06; declared, not claimed operating. INFD-IN-0002 files the tenant blocker as a tracked record rather than leaving it in message threads and a blueprint footnote. T07 and T08 now name their blocking intakes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR Assistant: claude-code Assistant-Model: opus Assistant-Process: 1565372@bnt-lap001 Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568 |
||
|---|---|---|
| docs | ||
| history/20260909-initial-exploration | ||
| informed_decision | ||
| intakes | ||
| schemas | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| GOAL.md | ||
| INTENT.md | ||
| layer.yaml | ||
| Makefile | ||
| pep-stance.yaml | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
informed-decision
User interface for executive decisions, modelled as a sign-and-return book — the German Umlaufmappe / Zeichnungsbuch, made cryptographic.
A Decision Memo carries a question, the context needed to answer it, the requested act, and a binding between identity, what was shown, and what was bound. The promise is not "the file was signed" but "this person, in this role, was shown this view, and bound this act."
One object model from a ten-second login (L0) to a multi-party instrument (L5).
Where to start
| File | What it is |
|---|---|
INTENT.md |
Why this repository exists and what it must never become |
GOAL.md |
The current stage, its invariants, and its definition of done |
workplans/ |
Current work |
history/20260909-initial-exploration/ |
Founding exploration — schema, state transitions, canonicalization, vectors |
Stage 1
Own the browser-facing approver UI that approval-engine deliberately does
not contain, and answer in writing who owns it. approval-engine is a
bearer-token resource server with no browser client; key-cape
(KEY-WP-0013-T02) is waiting on a client_id and callback URI that no
component has claimed. This repository claims them.
See GOAL.md.
Boundaries
This repository renders questions and records answers. It does not decide
(access-engine), does not own the approval object (approval-engine), does
not author approval doctrine (gate-house), does not authenticate anyone
(key-cape), and does not archive the trail (audit-core).